Larry Ponemon surveys companies every year to see how cost of dealing with breaches is trending. This year shows, among other things, that it costs companies an average of $217 per record breached. That means, on average, a small breach of say 10,000 records still costs $2 million. If you assume his numbers are high, half of that is still $1 million. Absent insurance, that is a large check to write.
Statistics from the report (see here, registration may be required) include:
- Cost per record breached has been around $210 +/- 5% since 2008. While it is good that the cost per record is not going up, total records last year were over 1 billion, so that is still a large check for people to write.
- Average total organizational cost is also basically flat since 2008 – in the $5 mil to $7 mil range per breach. This number is trending up a little bit over the last 4 years (up $1 mil from 2012, but down from the very highest year, 2011, which was $7.24 mil).
- Cost per record does vary by industry. Healthcare was the highest at $398 per record; public sector the lowest at $73 (the public sector is likely the lowest because you cannot sue city hall – at least not successfully). Other sectors were in the middle – financial at $259, services at $219, industrial at $190 and retail at $189, for example.
- 49% were caused by a malicious attack and 32% were caused by system or business process failures. The rest were attributed to human error (19%).
- Factors that influence the average cost per breached record include having an incident response team – $23.8 less, using encryption throughout – $19 less and board involvement – $9.8 less. On the other hand, lost and stolen devices adds $12 and if third parties are involved it adds $29.
- Churn (loss of customers) has a very big effect on average total cost. For companies with less than 1% churn, the average total cost is $5.5 mil, for companies with more than 4% churn, the average cost is $12.7 million – more than double.
The report has many other statistics, these are just a few of the highlights. Please click on the link above to see the report.
by 
